From f849e06b77c8a652c1ea119033825062147565db Mon Sep 17 00:00:00 2001
From: Eric Rakestraw <eric@rakestraw.us>
Date: Fri, 9 Oct 2026 04:11:50 +0000
Subject: [PATCH] Correct the unindexed sensitivity fixture

---
 docs/roadmap/remediation.md                |  5 ++++-
 internal/engine/secret_propagation_test.go | 19 +++++++++++++------
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/docs/roadmap/remediation.md b/docs/roadmap/remediation.md
index 744e30c..b7ec80f 100644
--- a/docs/roadmap/remediation.md
+++ b/docs/roadmap/remediation.md
@@ -49,7 +49,10 @@ the completion evidence with the actual implementation.
 
 ## 2. Correct the unindexed-sensitivity regression fixture (P2)
 
-Status: Open.
+Status: Complete. The fixture now uses canonical `/untracked` while leaving it
+unindexed, and explicitly checks that `/copy` is sensitive and `/ordinary` is
+not. The new assertion failed with the original malformed seed and passed after
+correction. The closure equivalence test and `./scripts/check.sh` passed.
 
 Affected: [secret_propagation_test.go](../../internal/engine/secret_propagation_test.go),
 `TestSecretDependencyClosureMatchesFixedPointScan`, the
diff --git a/internal/engine/secret_propagation_test.go b/internal/engine/secret_propagation_test.go
index 988ab56..888d1e6 100644
--- a/internal/engine/secret_propagation_test.go
+++ b/internal/engine/secret_propagation_test.go
@@ -7,11 +7,12 @@ import (
 
 func TestSecretDependencyClosureMatchesFixedPointScan(t *testing.T) {
 	tests := []struct {
-		name         string
-		paths        map[string]Path
-		seed         map[string]bool
-		dependencies []secretDependency
-		inherited    []secretDependency
+		name            string
+		paths           map[string]Path
+		seed            map[string]bool
+		dependencies    []secretDependency
+		inherited       []secretDependency
+		wantSensitivity map[string]bool
 	}{
 		{
 			name:  "forward reverse chains and cycles",
@@ -38,13 +39,14 @@ func TestSecretDependencyClosureMatchesFixedPointScan(t *testing.T) {
 		{
 			name:  "unindexed seed only activates inherited relations",
 			paths: secretPaths(Keys("ordinary"), Keys("copy")),
-			seed:  map[string]bool{"untracked": true},
+			seed:  secretSet(Keys("untracked")),
 			dependencies: []secretDependency{
 				{dependency: Keys("untracked"), target: Keys("ordinary")},
 			},
 			inherited: []secretDependency{
 				{dependency: Keys("untracked"), target: Keys("copy")},
 			},
+			wantSensitivity: map[string]bool{"/copy": true, "/ordinary": false},
 		},
 		{
 			name:  "inheritance direction root escapes and numeric spellings",
@@ -75,6 +77,11 @@ func TestSecretDependencyClosureMatchesFixedPointScan(t *testing.T) {
 			if !reflect.DeepEqual(got, want) {
 				t.Fatalf("closure = %#v, want %#v", got, want)
 			}
+			for pointer, sensitive := range test.wantSensitivity {
+				if got[pointer] != sensitive {
+					t.Errorf("sensitivity at %q = %v, want %v", pointer, got[pointer], sensitive)
+				}
+			}
 		})
 	}
 }